GRC-ARA:Mitigated Profiles in User Anlaysis

[Former Member]

Hello Experts,

I am working on GRC ARA and have a query regarding Mitigated Profiles.

The scenario I am trying is, we have a User - USER_A, to which a Role - Role_B having risk is assigned. The Profile of this Role, say Profile_C is mitigated using Mitigated Profiles Link.

Also, Param Id 1033 -'Include Role/Profile Mitigating Controls in Risk Analysis', in AC configuration setting is set to 'YES'.

So, when we perform User Level Risk Analysis on USER_A, should the Mitigation done at Profile level be displayed in the result of User Analysis ?

Thanks in Advance.

Regards,

Hira

[former_member193066]

well again.. its a business call.

i would not prefer to mitigate role or profile.always prefer to mitigate users.

when you run risk analysis at user level why you want to mitigate role or profile.

all the user who has the mitigate role will also get the control.

it might be risk for them not for this user.

thats my views.

Regards,

Prasant

[Colleen]

Hi Hira

My approach is roles should be mitigated as there is a chance that the generated profile could change. Profile mitigation applies to single non-generated profiles.

Or do you mean mitigate the user or mitigate the role/profile?

Regards

Colleen

[Former Member]

Hi Colleen,

Thanks for the reply.

My expectation here is if I am mitigating the Profile for a Risk, then the User associated to this profile via Role, should be mitigated.

The similar way it works for role, where if you mitigate the Role assigned to the User, using 'Mitigated Roles' Link, the User is shown is mitigated for that Risk if Param Id 1033 is set to 'Yes'.

Regards,

Hira

[Former Member]

Hi Hira,

Conceptually you are right, but like Colleen mentioned; it would be a better approach to mitigate over roles rather to mitigate the profiles.

Profiles might change every time the role gets modified-->generated.

Keeping mitigation on profiles would not be having the updated details for the authorizations, but if you do mitigation over roles then it would have.

Hope this is clear now.

Regards,

Ameet

[Colleen]

Hi Hira

Ameet and Prasant have responded with my thoughts already.

If you are running a user analysis you would focus on mitigating the user. If you mitigate role or profile then it applies to everyone - which you may not want. Also, is the risk inherent in the role or profile or is it due to a combination of roles?

You need to define the business process for how you want this to work. I usually aim for no inherent conflict.

Regards

Colleen